Retention
Data Retention & Deletion Schedule Checklist
A records schedule checklist to set retention periods, automate deletion, and handle backups and legal holds.
- Estimated time
- 4–10 Weeks
- Audience
- Privacy, Legal, IT, and Records Teams
- Last updated
Operational reference for retention programs. Legal holds and sector retention laws (tax, health, SOX) override deletion.
Progress is saved in this browser only. Nothing is sent to a server.
Phase 1: Inventory
Phase 2: Schedule
Phase 3: Implement
Phase 4: Prove
FAQ
Does GDPR require a specific number of years?+–
No. Retention must be limited to what is necessary for the purpose, plus legal duties.
Are backups in scope for erasure?+–
Often yes in principle; many programs isolate and expire backups on a cycle while pausing for legal hold.
Who owns the schedule?+–
Legal/records typically own periods; engineering owns execution.
Can we anonymize instead of delete?+–
If truly anonymized under applicable law, it may exit personal-data rules. Pseudonymization is not anonymization.
Related field notes
The checklists and field notes provided on this website are for educational and informational purposes only. They do not constitute legal, financial, or professional advice. Completing a checklist does not guarantee compliance, certification, or immunity from audits. Always consult with a certified auditor or legal counsel for your specific organizational needs. Full disclaimer